CVE-2025-59465High· 7.5▾ TwilightA malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`. Instead of safely closing the connection, the process crashes, enabling a remot…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.8 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 29.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
3.6%
3.6% → 4.0%
A malformed HTTP/2 HEADERS frame with oversized, invalid HPACK data can cause Node.js to crash by triggering an unhandled TLSSocket error ECONNRESET. Instead of safely closing the connection, the process crashes, enabling a remote denial of service. This primarily affects applications that do not attach explicit error handlers to secure sockets, for example:
server.on('secureConnection', socket => {
socket.on('error', err => {
console.log(err)
})
})
node.js >= 20.0.0, < 20.20.0node.js >= 22.0.0, < 22.22.0node.js >= 24.0.0, < 24.13.0node.js >= 25.0.0, < 25.3.0Upgrade past the affected range:
node.js 25.3.0Connected by shared product, vendor, weakness, or advisory.
CVE-2025-55130Critical· 9.1A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths
CVE-2018-12121High· 7.5Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Denial of Service with large HTTP headers: By using a combination of many requests with maximum sized headers (almost 80 KB per connection), and carefully timed c…
CVE-2018-12122High· 7.5Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Slowloris HTTP Denial of Service: An attacker can cause a Denial of Service (DoS) by sending headers very slowly keeping HTTP or HTTPS connections and associated …
CVE-2018-7164High· 7.5Node.js versions 9.7.0 and later and 10.x are vulnerable and the severity is MEDIUM
CVE-2018-7161High· 7.5All versions of Node.js 8.x, 9.x, and 10.x are vulnerable and the severity is HIGH
CVE-2018-7158High· 7.5The `'path'` module in the Node.js 4.x release line contains a potential regular expression denial of service (ReDoS) vector